wroclaw-git-backups/nix
1
0
Fork 0
mirror of https://github.com/NixOS/nix synced 2025-07-07 01:51:47 +02:00
Code Activity

Remove world-writability from per-user directories

Browse source 
'nix-daemon' now creates subdirectories for users when they first
connect.

Fixes #509 (CVE-2019-17365).
Should also fix #3127.
This commit is contained in:
Eelco Dolstra 2019-10-09 18:01:21 +02:00
parent 4331eeb13d
commit 5a303093dc
No known key found for this signature in database
GPG key ID: 8170B4726D7198DE
11 changed files with 41 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

24
src/libstore/local-store.cc
View file

@ -74,10 +74,11 @@ LocalStore::LocalStore(const Params & params)
multi-user install. */
if (getuid() == 0 && settings.buildUsersGroup != "") {
Path perUserDir = profilesDir + "/per-user";
createDirs(perUserDir);
if (chmod(perUserDir.c_str(), 01777) == -1)
throw SysError(format("could not set permissions on '%1%' to 1777") % perUserDir);
for (auto & perUserDir : {profilesDir + "/per-user", gcRootsDir + "/per-user"}) {
createDirs(perUserDir);
if (chmod(perUserDir.c_str(), 0755) == -1)
throw SysError("could not set permissions on '%s' to 755", perUserDir);
}
mode_t perm = 01775;
@ -1432,4 +1433,19 @@ void LocalStore::signPathInfo(ValidPathInfo & info)
}
void LocalStore::createUser(const std::string & userName, uid_t userId)
{
for (auto & dir : {
fmt("%s/profiles/per-user/%s", stateDir, userName),
fmt("%s/gcroots/per-user/%s", stateDir, userName)
}) {
createDirs(dir);
if (chmod(dir.c_str(), 0700) == -1)
throw SysError("changing permissions of directory '%s'", dir);
if (chown(dir.c_str(), userId, -1) == -1)
throw SysError("changing owner of directory '%s'", dir);
}
}
}